SBOM Attestation
Signing Nix-Generated SBOMs With Sigstore Cosign
Nix's hermetic builds and Cosign's keyless signing create verifiable software supply chain evidence.
Adaeze Okonkwo · October 23, 2026 · 8 min read
Section
SBOM Attestation
3 stories in SBOM Attestation
SBOM Attestation
Verifying Upstream Nixpkgs Derivation Provenance Before Consuming It
Nix provides strong build guarantees but cannot verify that upstream code itself is trustworthy.
Tobias Wrenfeld · October 22, 2026 · 9 min read
SBOM Attestation
SLSA Provenance Generation for Nix Builds
Nix's hermetic builds need external attestation to meet SLSA requirements.
Adaeze Okonkwo · October 18, 2026 · 8 min read